AWS lake-formation documentation change

Service: lake-formation · 2025-08-28 · Documentation low

File: lake-formation/latest/dg/redshift-ns-prereqs.md

Summary

Removed KMS key policy JSON example for Redshift integration

Security assessment

Example policy removal does not address a security issue. May reflect updated guidance but lacks evidence of vulnerability mitigation.

Diff

diff --git a/lake-formation/latest/dg/redshift-ns-prereqs.md b/lake-formation/latest/dg/redshift-ns-prereqs.md
index 3393f5810..373ca7595 100644
--- a//lake-formation/latest/dg/redshift-ns-prereqs.md
+++ b//lake-formation/latest/dg/redshift-ns-prereqs.md
@@ -175,91 +174,0 @@ For more information about managing the permissions of a customer managed key, s
-JSON
-    
-
-****
-    
-    
-        {
-        "Version": "2012-10-17",
-        "Id": "auto-redshift-3",
-        "Statement": [
-            {
-                "Sid": "AllowAccessThroughRedShift",
-                "Effect": "Allow",
-                "Principal": {
-                    "AWS": "*"
-               },
-                "Action": [
-                    "kms:Encrypt",
-                    "kms:Decrypt",
-                    "kms:ReEncrypt*",
-                    "kms:GenerateDataKey*",
-                    "kms:CreateGrant",
-                    "kms:DescribeKey"
-                ],
-                "Resource": "*",
-                "Condition": {
-                    "StringEquals": {
-                        "kms:CallerAccount": "111122223333",
-                        "kms:ViaService": "redshift.us-east-1.amazonaws.com"
-                    }
-                }
-            },
-            {
-            "Sid": "AllowAccessThroughRedShiftServerless",
-            "Effect": "Allow",
-            "Principal": {
-                "AWS": "*"
-            },
-            "Action": [
-                "kms:Encrypt",
-                "kms:Decrypt",
-                "kms:ReEncrypt*",
-                "kms:GenerateDataKey*",
-                "kms:CreateGrant",
-                "kms:DescribeKey"
-            ],
-            "Resource": "*",
-            "Condition": {
-                "StringEquals": {
-                    "kms:CallerAccount": "111122223333",
-                    "kms:ViaService": "redshift-serverless.us-east-1.amazonaws.com"
-                }
-            }
-            },
-            {
-                "Sid": "AllowDirectAccessToKeyMetadata",
-                "Effect": "Allow",
-                "Principal": {
-                    "AWS": "arn:aws:iam::111122223333:root"
-                },
-                "Action": [
-                    "kms:Describe*",
-                    "kms:Get*",
-                    "kms:List*",
-                    "kms:RevokeGrant"
-                ],
-                "Resource": "*"
-            },
-           {            
-                "Sid": "AllowGenerateDataKeyDecrypt",
-                "Effect": "Allow",
-                "Principal": {
-                    "AWS": "arn:aws:iam::111122223333 :role/data-transfer-role-name"
-                },
-                "Action": [
-                    "kms:GenerateDataKey",
-                    "kms:Decrypt"
-                ],
-                "Resource": "*",
-                "Condition": {
-                "StringEquals": {
-                "kms:ViaService": "s3.us-east-1.amazonaws.com"
-        }
-        }
-            }
-            
-        ]
-    }
-            
-    
-